In a presentation at the Defcon security conference earlier this
month, researchers Alex Pilosov and Tony Kapela demonstrated an
attack which exploited the Border Gateway Protocol (BGP).

The protocol allows for the exchange of information between
networks of autonomous systems. To do this, BGP maintains a table
of available IP networks, and finds the most efficient routes for
internet traffic. In their presentation, Pilosov and Kapela
demonstrated how a user's BGP traffic could be hijacked and
redirected, allowing supposedly secure communications to be
intercepted.

The researchers showed a man-in-the-middle attack where 'Time
to Live' (TTL) information in data packets was spoofed on the fly,
fooling routers into redirecting information to the attackers'
network. The attack is surreptitious, as the altered TTL of the
packets effectively hides the IP devices handling the hijacked
inbound and outbound traffic.

Andy Buss, a senior analyst at Canalys, said on
Wednesday that this issue with BGP had been known about for at
least 10 years. Peiter 'Mudge' Zatko, an information security
expert, warned a hearing of the US Senate Committee on Governmental
Affairs in 1998 that hackers could exploit BGP, said Buss, who
added that the problem was essentially to do with trust.

"The whole internet infrastructure is based on the assumption
of trust, with security overlaid on top," said Buss. "This is an
inherent problem: that internet infrastructure is insecure."

Buss said that the BGP problem was an issue that only internet service
providers (ISPs) could remedy.

"Generally it's carriers that [use] BGP, and the issue is
really about strictly managing the BGP set," said Buss. "Ideally
ISPs should only allow authenticated servers to propagate changes,
but that means everyone in the trust chain would have to
participate. The easiest mitigation is that ISPs monitor their
address space, and monitor who is peering with BGP through
blacklists and whitelists."

The only action available to businesses would be to put more
pressure on ISPs to make sure their networks were hardened and that
they were moving towards encrypting internet traffic, said Buss.
However, the analyst said he does not expect change to come
quickly.

"Open relays [which forwarded all traffic, including spam] took
years to close. Botnets are a problem which has been around for
years, yet ISPs aren't filtering traffic," said Buss. "Things
move slowly. It will take a long time to get service providers to
act."

Thank You

By registering you become a member of the CBS Interactive family of sites and you have read and agree to the Terms of Use, Privacy Policy and Video Services Policy. You agree to receive updates, alerts and promotions from CBS and that CBS may share information about you with our marketing partners so that they may contact you by email or otherwise about their products or services.
You will also receive a complimentary subscription to the ZDNet's Tech Update Today and ZDNet Announcement newsletters. You may unsubscribe from these newsletters at any time.